The request type when fetching to S3

Question

Hi all,

I would like to connect S3 and microsoft sentinel.

I have a question.

・I think you fetch files from microsoft sentinel to S3, is the request type GET?

The following is the page to which we refer.

https://learn.microsoft.com/ja-jp/azure/sentinel/connect-aws?tabs=s3

Answer 1

Hi @横田　大和 ,

The article you linked is about fetching from S3 to Sentinel and not the other way around. The Amazon Web Services S3 connector allows you to ingest AWS service logs to Sentinel, and it can ingest logs from various AWS sources. You need to use the connector to do this and the logs flow from AWS to Sentinel.

https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/troubleshoot-amazon-web-services-s3-connector-issues/ba-p/3608072

To query files from Microsoft Sentinel, you can use the Log Analytics agent. https://learn.microsoft.com/en-us/azure/sentinel/connect-custom-logs?tabs=DCG

You can use the Sentinel API with a Get request to query incidents, if this is what you were hoping to accomplish:

https://learn.microsoft.com/en-us/rest/api/securityinsights/But the connector isn't designed for bi-directional flow between Sentinel and S3.

If the information helped you, please Accept the answer. This will help us as well as others in the community who may be researching similar questions.